fix(cli): strip terminal escapes from OAuth error text (GHSA-q9j4-4h4j-mv5m)

[gregberge]

Fixes GHSA-q9j4-4h4j-mv5m.

argos login printed the error_description of a failed OAuth callback verbatim. The authorization server is whatever ARGOS_APP_BASE_URL points at, so a hostile one could embed ANSI escape sequences and carriage returns that erase and repaint terminal lines — enough to forge a trusted-looking "run this command to continue" instruction under the CLI's own name.

Fix

sanitizeTerminalText() (packages/cli/src/lib/terminal.ts) reduces remote text to something a terminal can only display:

• escape sequences (CSI, OSC and the plain ones) are dropped with the bytes that belong to them, so no [2K remnant is left as text;
• remaining control characters become spaces (a dropped \r would splice foo\rbar into one word);
• explicit directional formatting, the other way to make a line read as something it does not say, is dropped;
• the result is collapsed onto one line and capped at 200 characters.

Applied to the loopback callback's error / error_description and to the token endpoint's error payload, which reaches the same terminal through OAuthTokenError. When nothing printable is left, the CLI falls back to a message of its own instead of printing a blank error.

Tests

• src/lib/terminal.test.ts covers the sanitizer, including the advisory's payload.
• src/commands/login.test.ts drives that payload through the real callback server and asserts the rejection carries no escape character, plus the success path and the empty-description fallback.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
argos-js-sdk-reference	Ready	Preview	Sep 13, 2026 8:04am UTC

[Copilot]

🟢 Approval recommended

Untrusted OAuth messages are consistently sanitized, bounded, and covered by focused tests.

Pull request overview

Adds terminal-safe handling for untrusted OAuth errors, addressing GHSA-q9j4-4h4j-mv5m.

Changes:

• Adds terminal-text sanitization with length limits.
• Sanitizes callback and token-endpoint errors.
• Adds sanitizer and callback integration tests.

File summaries

File	Description
packages/cli/src/lib/terminal.ts	Implements terminal-text sanitization.
packages/cli/src/lib/terminal.test.ts	Tests sanitization behavior and advisory payload.
packages/cli/src/lib/oauth.ts	Sanitizes token-endpoint errors.
packages/cli/src/commands/login.ts	Sanitizes OAuth callback errors.
packages/cli/src/commands/login.test.ts	Tests callback success and safe failures.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.